{"id":5882,"date":"2026-09-30T09:29:05","date_gmt":"2026-09-30T09:29:05","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/09\/30\/starlette-flaw-cve-2026-48710-cisa-avertissements-dexploitation-active\/"},"modified":"2026-09-30T09:29:06","modified_gmt":"2026-09-30T09:29:06","slug":"starlette-flaw-cve-2026-48710-cisa-avertissements-dexploitation-active","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/fr\/2026\/09\/30\/starlette-flaw-cve-2026-48710-cisa-avertissements-dexploitation-active\/","title":{"rendered":"Starlette Flaw CVE-2026-48710: CISA Avertissements d&#8217;exploitation active"},"content":{"rendered":"<div id=\"netgu-2006478442\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p class=\"wp-block-paragraph\"><strong>L&#8217;agence am\u00e9ricaine de cybers\u00e9curit\u00e9 CISA a ajout\u00e9 CVE-2026-48710, une vuln\u00e9rabilit\u00e9 dans le cadre Python largement utilis\u00e9 Starlette, \u00e0 son catalogue de vuln\u00e9rabilit\u00e9s exploit\u00e9es connues (KEV) le 2 septembre 2026. Les attaquants abusent d\u00e9j\u00e0 du d\u00e9faut dans la nature pour contourner les v\u00e9rifications d&#8217;authentification.<\/strong><\/p>\n\n<h3 class=\"wp-block-heading\">Une t\u00eate d&#8217;h\u00f4te alt\u00e9r\u00e9e empoisonne le chemin<\/h3>\n\n<p class=\"wp-block-paragraph\">Au c\u0153ur du probl\u00e8me se trouve la validation manquante de l&#8217;en-t\u00eate HTTP Host. Starlette assemble le <code>request.url<\/code> propri\u00e9t\u00e9 \u00e0 partir de l&#8217;en-t\u00eate d&#8217;h\u00f4te contr\u00f4lable par l&#8217;attaquant et du chemin de requ\u00eate, puis repares le r\u00e9sultat. En cons\u00e9quence, <code>request.url.path<\/code> peut diverger du chemin utilis\u00e9 par le serveur ASGI pour le routage. Si un intergiciel \u00e9value les droits d&#8217;acc\u00e8s bas\u00e9s sur <code>request.url.path<\/code>, il \u00e9value un chemin falsifi\u00e9 tandis que la route v\u00e9ritablement prot\u00e9g\u00e9e s&#8217;ex\u00e9cute toujours en arri\u00e8re-plan.<\/p><div id=\"netgu-4214657429\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/moon-knight-digital-watch-face-fuer-wear-os-4\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/deal-27-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">MOON KNIGHT Digital Watch Face f\u00fcr Wear OS 4+<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>0.89 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/train-sim-world-7-starter-pack-kostenlos-fuer-ps4-ps5-xbox-pc\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/capsule_616x353-11-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Train Sim World 7: Starter Pack kostenlos f\u00fcr PS4, PS5, Xbox, PC<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ml2u-watchfaces-fuer-wearos-im-google-play-store-2\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844734_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">ML2U Watchfaces f\u00fcr WearOS im Google Play Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>1.39 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenloses-dlc-bundle-fuer-gears-of-war-e-day-liquid-death-bundle\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844571_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenloses DLC-Bundle f\u00fcr Gears of War E-Day \u2013 Liquid Death Bundle<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenlose-emote-im-clash-royale-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/share-image-clashroyale-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenlose Emote im Clash Royale-Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n\n<p class=\"wp-block-paragraph\">Le r\u00e9sultat est un contournement d&#8217;authentification pour les attaquants non authentifi\u00e9s sur le r\u00e9seau. Le d\u00e9faut CWE-444 (transfert de demandes de PTTS) porte un score de CVSS de 6,5, moyen cot\u00e9. Sa port\u00e9e est n\u00e9anmoins consid\u00e9rable, car Starlette sous-tend le cadre web populaire FastAPI et se trouve \u00e0 l&#8217;int\u00e9rieur d&#8217;innombrables API de production.<\/p>\n\n<h3 class=\"wp-block-heading\">Appliquer la mise \u00e0 jour \u00e0 la version 1.0.1<\/h3>\n\n<p class=\"wp-block-paragraph\">Les responsables ont corrig\u00e9 la faille dans Starlette 1.0.1. Cette version valide l&#8217;en-t\u00eate Host contre RFC 9112 et RFC 3986 et revient \u00e0 <code>scope[\"server\"]<\/code> pour les valeurs non valides. Les op\u00e9rateurs devraient mettre \u00e0 jour rapidement; les chercheurs notent que le d\u00e9faut peut \u00eatre encha\u00een\u00e9 avec CVE-2026-42271 pour l&#8217;ex\u00e9cution de code \u00e0 distance contre les instances LiteLLM. La CISA exige des organismes f\u00e9d\u00e9raux am\u00e9ricains qu&#8217;ils rem\u00e9dient \u00e0 cette vuln\u00e9rabilit\u00e9 d&#8217;ici le 16 septembre 2026.<\/p>\n\n<p class=\"wp-block-paragraph\"><em>Sources : <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/09\/02\/cisa-adds-seven-known-exploited-vulnerabilities-catalog\" rel=\"noopener\" target=\"_blank\">CISA KEV Alerte<\/a> \u00b7 <a href=\"https:\/\/advisories.gitlab.com\/pypi\/starlette\/CVE-2026-48710\/\" rel=\"noopener\" target=\"_blank\">Base de donn\u00e9es consultatives GitLab<\/a> \u00b7 <a href=\"https:\/\/thehackernews.com\/2026\/09\/cisa-adds-seven-exploited-flaws-as.html\" rel=\"noopener\" target=\"_blank\">Les nouvelles Hacker<\/a><\/em><\/p><div id=\"netgu-3132690011\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Une faiblesse d&#8217;en-t\u00eate de l&#8217;h\u00f4te dans le cadre Python Starlette contourne les contr\u00f4les d&#8217;acc\u00e8s bas\u00e9s sur le chemin. CISA a ajout\u00e9 le bug \u00e0 son catalogue de vuln\u00e9rabilit\u00e9s exploit\u00e9es le 2 septembre.<\/p>\n","protected":false},"author":1,"featured_media":1722,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-5882","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/5882","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=5882"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/5882\/revisions"}],"predecessor-version":[{"id":5883,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/5882\/revisions\/5883"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1722"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=5882"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=5882"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=5882"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}